Is CFCA CertEnrollment.YZW Extension safe?

Low risk

CFCA CertEnrollment.YZW Extension bridges web pages to local native messaging hosts using a caller-supplied host name with no allowlist.

The extension acts as a native messaging relay for CFCA PKI operations, accepting connections from a fixed set of Chinese enterprise domains (yzw.cn, cscec.com, paic.com.cn, and others). When a page on one of those domains sends a connect action, the extension passes the caller-supplied host name directly to chrome.runtime.connectNative without validating it against any allowlist. This means any page within the permitted domains can direct the bridge to connect to any native messaging host installed on the user's system, not just the intended CFCA PKI application.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

developerv3.2.0.5Chrome Web Store
20Risk
Who publishes it

developer - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
developer

Same store account

1 other listing published from this account, 6k+ users between them, none of them carrying a finding.

CFCA CryptoKit.YZW Extension6k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.2.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on yzw.cn

    https://*.yzw.cn/* and 1 more

  • Read and change your data on yzw.cn.qa

    http://*.yzw.cn.qa/* and 1 more

  • Read and change your data on yzwdev.cn

    http://*.yzwdev.cn/* and 1 more

  • Read and change your data on yzwqa.cn

    http://*.yzwqa.cn/* and 1 more

  • Read and change your data on cscec.com

    http://*.cscec.com/* and 1 more

  • Read and change your data on paic.com.cn

    http://*.paic.com.cn/* and 1 more

  • Read and change your data on cscec3b.com.cn

    http://*.cscec3b.com.cn/* and 1 more

  • Read and change your data on 3jyx.cn

    http://*.3jyx.cn/* and 1 more

  • Talk to a program installed on your computer, outside the browser's sandbox

    nativeMessaging

Updated 30 September 2026ammjngimknmmohokfkjhoaihoappnlbl